GhostDep — catches packages your AI made up

GhostDep checks the packages an AI assistant tells you to install, before you install them. AI assistants sometimes invent package names that sound right but do not exist. Attackers register those names and wait for someone to paste the install command. GhostDep reads the install commands in an answer and looks each package up on the real registry. What it flags - Packages that do not exist on the registry - Packages first published in the last 30 days - Names one edit away from a well-known package, with the likely intended name - A Python import name used where the package name belongs - A command that belongs to a differently named package - Packages the registry marks as deprecated What it reads Install commands for Python, JavaScript and Rust packages, and dependency lists shown in code blocks. Where it runs Automatically on popular AI chat sites. On any other page, click the toolbar icon and choose "Scan this page". The full list of supported sites and commands is on the project page. Privacy Only package names are sent, only to the public registry they would be installed from, and well-known names are never sent. No chat text, no analytics, no account. Limits GhostDep checks existence, age, popularity and deprecation. It does not scan package code, so an established package that has been compromised will still pass.